Privacy Policy

1. Information We Collect

We collect information you provide directly to us when you sign up for our waitlist, create a member account, make a donation, or contact us. This includes:

• **Identity Information**: First name and last name.
• **Contact and Account Information**: Email address and account password hash (if registering for a user account to track your donations).
• **Payment Metadata**: We receive transaction confirmations and billing details from Stripe, but we do **not** store or have access to raw credit card numbers.
• **Usage Data**: Placed tile coordinates, biome preferences, and session timestamps.

2. How We Use Your Information

We use the collected information for the following purposes:

• To manage user accounts and authenticate donor login sessions.
• To send waitlist updates and confirm your spot.
• To associate placed digital tiles in the shared 3D world with your donor identity.
• To route your donation details securely to Stripe and our charity routing partner (Pledge.to).
• To send tax-deductible receipt copies if requested.

3. Information Sharing and Third-Party Processors

We do not sell your personal data. We share your information only with trusted third-party providers essential to hosting the application, managing database structures, and processing your donations:

• **Stripe**: To securely process donation payments.
• **Pledge.to**: To programmatically distribute funds directly to our ground NGOs.
• **Supabase**: Used for database storage, session state management, and user authentication. Account profiles and placed world object data are stored securely on Supabase cloud servers.
• **Vercel**: Used to host the web application and run serverless functions. Vercel processes request routing, IP address logs for security filtering, and standard edge network transactions.
• **Vetted Charities**: Recipient charities (GRID Alternatives, Ocean Conservancy, One Tree Planted) may receive donor name listings for tax-deductibility compliance.

4. Security of Data

We use industry-standard measures (including Supabase Row Level Security and SSL encryption) to protect all databases, transactions, and session states. However, no internet-based system is 100% secure, and we cannot guarantee absolute data protection.